Lucene search
+L

7255 matches found

Github Security Blog
Github Security Blog
added 2026/05/07 5:14 a.m.23 views

Netty MQTT: Resource exhaustion in MqttDecoder

Impact The MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader method is called before the bytesRemainingBeforeVariableHeader maxBytesInMessage check. The decodeVariableHeader can call other metho...

7.5CVSS5.9AI score0.00489EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/05/07 5:6 a.m.19 views

MGASA-2026-0117 Updated graphicsmagick packages fix security vulnerabilities

ImageMagick has a heap overflow in the pcd decoder that leads to an out of bounds read. CVE-2026-26284 ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction. CVE-2026-33535...

9.1CVSS5.8AI score0.00404EPSS
SaveExploits0References4
OSV
OSV
added 2026/05/07 2:7 a.m.27 views

GHSA-W239-58X2-Q8P5 go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth

The DAG-CBOR and DAG-JSON decoders recurse on each nested map or list without a depth limit. A payload containing deeply nested collections causes the decoder to recurse once per level, growing the goroutine stack until the Go runtime terminates the process with a fatal stack overflow distinct fr...

6.2CVSS6AI score0.0012EPSS
SaveExploits0References3
OSV
OSV
added 2026/05/07 12:20 a.m.11 views

GHSA-MJ4R-2HFC-F8P6 Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Summary Lz4FrameDecoder allocates a ByteBuf of size decompressedLength up to 32 MB per block before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. Details...

7.5CVSS5.8AI score0.00429EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/05/07 12:20 a.m.22 views

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec is an event-driven asynchronous network application framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Lz4FrameDecoder component. An attacker can cause excessive memory allocation by sending...

8.7CVSS5.8AI score0.00429EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 12:20 a.m.15 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Lz4FrameDecoder component. An attacker can cause excessive memory allocation by sending specially crafted compressed data with manipulated header fields, leading to resource...

8.7CVSS5.8AI score0.00429EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 12:19 a.m.6 views

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value through the decodeHuffmanEncodedLiteral function in the QPACK decoder, which allocates memory for a byte array based on a length value received from the network without verifying that sufficie...

8.7CVSS5.8AI score0.00437EPSS
SaveExploits1References2
OSV
OSV
added 2026/05/07 12:18 a.m.5 views

GHSA-XXQH-MFJM-7MV9 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization | Field | Value | |-----------|-------| | Library | io.netty:netty-codec-http | | Component | codec-http — HttpObjectDecoder | | Severity | HIGH | | Affects | HEAD, commit 4f3533ae confirmed | --- Summary HttpObjectDecoder strips a...

5.8CVSS5.8AI score0.00607EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/05/07 12:12 a.m.19 views

Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty Encoder + Decoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-dns | | Component | io.netty.handler.codec.dns.DnsCodecUtil | |...

9.1CVSS5.8AI score0.00969EPSS
SaveExploits1References5Affected Software1
Positive Technologies
Positive Technologies
added 2026/05/07 12:0 a.m.24 views

PT-2026-38399

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description Resource exhaustion occurs because the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. In the MqttDecoder class, the decodeVariableHeader...

7.5CVSS5.8AI score0.00489EPSS
SaveExploits0References414
Positive Technologies
Positive Technologies
added 2026/05/07 12:0 a.m.34 views

PT-2026-38374

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final Description In the HttpObjectDecoder component, the software fails to strip the Content-Length header when an HTTP/1.0 request contains both Transfer-Encoding: chunked...

9.8CVSS5.8AI score0.00607EPSS
SaveExploits1References412
Tenable Nessus
Tenable Nessus
added 2026/05/07 12:0 a.m.24 views

Linux Distros Unpatched Vulnerability : CVE-2026-43235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: media: iris: Add missing platform data entries for SM8750 Two platform-data fields for SM875...

5.5CVSS5.3AI score0.00126EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 11:5 p.m.72 views

Memory Allocation with Excessive Size Value

Overview Nerdbank.MessagePack is an A modern, fast and NativeAOT-compatible MessagePack serialization library Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value the TryRead timestamp decoder in MessagePackPrimitives.Readers.cs. An attacker can crash...

8.7CVSS5.8AI score0.00353EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/06 6:3 p.m.10 views

CLSA-2026-1778090588 libtiff: Fix of CVE-2026-4775

CVE-2026-4775: fix signed integer overflow in YCbCr tile decoder helpers in TIFFReadRGBAImage that could lead to heap overflow on crafted images with huge width...

7.8CVSS5.9AI score0.00553EPSS
SaveExploits0References1
OSV
OSV
added 2026/05/06 12:6 p.m.10 views

SUSE-SU-2026:1712-1 Security update for openexr

This update for openexr fixes the following issues: - CVE-2026-40244: Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic bsc1262426. - CVE-2026-40250: Integer overflow in DWA decoder outBufferEnd pointer arithmetic bsc1262425...

8.4CVSS5.9AI score0.0045EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/05/06 11:28 a.m.7 views

CVE-2026-43263

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Null reference while testing fluster When multi instances are created/destroyed, many interrupts happens and structures for decoder are removed. "struct vpuinstance" this structure is shared for all...

5.8AI score0.00119EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2026/05/06 11:28 a.m.24 views

CVE-2026-43263

The CVE-2026-43263 entry concerns the Linux kernel chips-media wave5 driver. The vulnerability arises when multiple driver instances are created and destroyed, causing many interrupts and removal of decoder structures. The shared vpu_instance structure is not protected by a lock, allowing a poten...

7.8CVSS5.8AI score0.00119EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/05/06 11:28 a.m.5 views

CVE-2026-43263 media: chips-media: wave5: Fix Null reference while testing fluster

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Null reference while testing fluster When multi instances are created/destroyed, many interrupts happens and structures for decoder are removed. "struct vpuinstance" this structure is shared for all...

7.8CVSS6.5AI score
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/05/06 6:52 a.m.11 views

pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE 0x30 or SET 0x31 tags with Indefinite Length 0x80 markers. Thi...

7.5CVSS6.8AI score0.00803EPSS
SaveExploits1References6
CNNVD
CNNVD
added 2026/05/06 12:0 a.m.13 views

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper interrupt handling during the creation and destruction of multiple instances in the...

7.8CVSS5.8AI score0.00119EPSS
SaveExploits0References1
Rows per page
Query Builder